Privacy policy
Last updated: November 2026.
This policy explains what personal data we process when you read soclya.com, create an account, comment or write to us, and what rights you have. It follows the EU General Data Protection Regulation (GDPR) and Spanish data protection law.
1. Data controller
The controller is Soclya (see the legal notice). For anything about your data, write to legal@soclya.com.
2. What we process and why
If you only read the site. We ask for no data and do not track you. Our servers technically log the IP address, the browser and the page requested, to deliver the page and protect it against attacks. We never use this to build profiles. We count story views in aggregate, without identifying you.
If you create an account. We process:
- your name, username and e-mail address;
- your password, stored only as a secure hash that nobody can read;
- your date of birth, only to check you are at least 16. It is never shown;
- anything you add to your profile: photo, cover, bio, location, website and social links.
We e-mail you one-time codes to confirm your account or recover access.
If you comment. We process the text of your comment, its date and the story. Your name, username and photo are shown publicly next to it.
If you write to us or send a tip. We process your name, e-mail, message and any attachments. We protect our sources' identity.
Security. For each session we keep the IP address, browser and dates. We also keep a log of sensitive actions, such as sign-ins and password changes. Forms use an anti-spam check (Cloudflare Turnstile).
3. Legal basis
| Processing | Legal basis (Art. 6 GDPR) |
|---|---|
| Account and comments | Performance of the contract you accept when you sign up |
| Answering your messages and tips | Your consent, given when you send them |
| Security, spam and abuse prevention | Our legitimate interest in protecting the site and its users |
| Legal duties, e.g. answering an authority | Legal obligation |
We do not sell your data, build profiles or send advertising.
4. How long we keep it
- Account: until you delete it. Your profile and comments are then removed.
- Messages and tips: up to 24 months after the last contact.
- Security logs: 12 months.
- Backups: these rotate regularly. Deleted data disappears from them in the next cycle.
Where the law requires us to keep something for longer, it is locked and used only for that purpose.
5. Who helps us (processors)
- Cloudflare, Inc.: hosting, database, image storage, delivery, protection and anti-spam checks.
- Proton AG (Switzerland) and our e-mail delivery provider: e-mail, and sending codes and notices.
These processors act only on our instructions, under contracts that require them to protect the data. Automatic translation of the news runs on Cloudflare's infrastructure and does not use your personal data.
6. International transfers
Some providers may process data outside the European Economic Area. When they do, the GDPR safeguards apply:
- adequacy decisions (Switzerland, and the EU-US Data Privacy Framework for certified companies);
- the European Commission's standard contractual clauses.
7. Security
We use:
- encrypted connections (HTTPS);
- hashed passwords and encryption of sensitive data;
- two-step verification for newsroom staff;
- limits against abusive sign-in attempts.
If a breach affects you, we will tell you. We will also notify the supervisory authority where the law requires it.
8. Children
Accounts are for people aged 16 or over. If we learn that an account belongs to someone younger, we will delete it.
9. Your rights
You can exercise these rights at any time:
- access: find out what data we hold about you;
- rectification: correct it;
- erasure: delete it;
- portability: download it;
- restriction of processing;
- objection to processing.
You can do much of this yourself in My account: edit your profile, download your data or delete your account. For anything else, write to legal@soclya.com. We reply within one month.
You may also complain to a data protection authority, such as the Spanish AEPD (aepd.es) or the one where you live.
We make no automated decisions that have legal effects on you.
10. Changes
If we change this policy, we will update the date above. If a change is significant, we will tell you by e-mail or on the site.